修正バージョン
バージョンを確認する
python3 -V3.10 に影響するCVE
| CVE | タイトル | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer ove... | 9.8 | — | 2022-10-21 | |
| CVE-2019-12900 | BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors... | 9.8 | — | 2019-06-20 | |
| CVE-2007-4559 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Pyt... | 9.8 | — | 2007-08-28 | |
| CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | — | 2026-07-10 | |
| CVE-2015-20107 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discover... | 7.8 | — | 2022-04-13 | |
| CVE-2022-42919 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-defaul... | 7.8 | — | 2022-11-06 | |
| CVE-2022-0391 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resou... | 7.5 | — | 2022-02-09 | |
| CVE-2018-25032 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many dist... | 7.5 | — | 2022-03-25 | |
| CVE-2022-45061 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when pr... | 7.5 | — | 2022-11-09 | |
| CVE-2023-24329 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods... | 7.5 | — | 2023-02-17 | |
| CVE-2023-36632 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError... | 7.5 | — | 2023-06-25 | |
| CVE-2024-7592 | Quadratic complexity parsing cookies with backslashes | 7.5 | — | 2024-08-20 | |
| CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | 7.5 | — | 2024-09-03 | |
| CVE-2022-26488 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately se... | 7.0 | — | 2022-03-08 | |
| CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | 7.0 | — | 2026-03-21 | |
| CVE-2016-3189 | Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of servi... | 6.5 | — | 2016-07-01 | |
| CVE-2021-3733 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server th... | 6.5 | — | 2022-03-07 | |
| CVE-2021-28861 | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection again... | 6.5 | — | 2022-08-23 | |
| CVE-2025-13836 | Excessive read buffering DoS in http.client | 6.3 | — | 2025-12-02 | |
| CVE-2025-12084 | Quadratic complexity in node ID cache clearing | 6.3 | — | 2025-12-04 | |
| CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | 6.3 | — | 2026-01-22 | |
| CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 6.3 | — | 2026-05-12 | |
| CVE-2020-10735 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using in... | 6.2 | — | 2022-09-09 | |
| CVE-2026-3644 | Incomplete control character validation in http.cookies | 6.0 | — | 2026-03-17 | |
| CVE-2026-3087 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | 6.0 | — | 2026-04-28 | |
| CVE-2021-3426 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another... | 5.7 | — | 2021-05-20 | |
| CVE-2021-4189 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive)... | 5.3 | — | 2022-08-24 | |
| CVE-2023-27043 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character... | 5.3 | — | 2023-04-18 | |
| CVE-2023-40217 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before... | 5.3 | — | 2023-08-25 | |
| CVE-2024-9287 | Virtual environment (venv) activation scripts don't quote paths | 5.3 | — | 2024-10-23 | |
| CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | 4.1 | — | 2026-06-24 | |
| CVE-2025-13837 | Out-of-memory when loading Plist | 2.1 | — | 2025-12-02 | |
| CVE-2026-6019 | BaseCookie.js_output() does not neutralize embedded characters | 2.1 | — | 2026-04-23 | |
| CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 2.0 | — | 2026-03-13 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。